CVE-2022-48787 (GCVE-0-2022-48787)

Vulnerability from cvelistv5 – Published: 2024-07-16 11:43 – Updated: 2026-08-05 08:52
VLAI
Title
iwlwifi: fix use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: iwlwifi: fix use-after-free If no firmware was present at all (or, presumably, all of the firmware files failed to parse), we end up unbinding by calling device_release_driver(), which calls remove(), which then in iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However the new code I added will still erroneously access it after it was freed. Set 'failure=false' in this case to avoid the access, all data was already freed anyway.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8e10749fa1a454c1e7214f36cec83241f5a36ef1 , < d3b98fe36f8a06ce654049540773256ab59cb53d (git)
Affected: 1d7cc54137a4f28506dc7beac235b240b08f4e59 , < 7d6475179b85a83186ccce59cdc359d4f07d0bcb (git)
Affected: 0446cafa843e6db4982731c167e11c80d42be7e2 , < 494de920d98f125b099f27a2d274850750aff957 (git)
Affected: febab6b60d61d13cd9f30a2991deea56df39567d , < 008508c16af0087cda0394e1ac6f0493b01b6063 (git)
Affected: e23f075d77987de4215c8e0696f28bcc707506f7 , < ddd46059f7d99119b62d44c519df7a79f2e6a515 (git)
Affected: 6b5ad4bd0d78fef6bbe0ecdf96e09237c9c52cc1 , < 9958b9cbb22145295ee1ffaea0904c383da2c05d (git)
Affected: ab07506b0454bea606095951e19e72c282bfbb42 , < bea2662e7818e15d7607d17d57912ac984275d94 (git)
Create a notification for this product.
Linux Linux Affected: 4.14.263 , < 4.14.268 (semver)
Affected: 4.19.226 , < 4.19.231 (semver)
Affected: 5.4.174 , < 5.4.181 (semver)
Affected: 5.10.94 , < 5.10.102 (semver)
Affected: 5.15.17 , < 5.15.25 (semver)
Affected: 5.16.3 , < 5.16.11 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.764Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48787",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:59:49.027467Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:16.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/iwl-drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d3b98fe36f8a06ce654049540773256ab59cb53d",
              "status": "affected",
              "version": "8e10749fa1a454c1e7214f36cec83241f5a36ef1",
              "versionType": "git"
            },
            {
              "lessThan": "7d6475179b85a83186ccce59cdc359d4f07d0bcb",
              "status": "affected",
              "version": "1d7cc54137a4f28506dc7beac235b240b08f4e59",
              "versionType": "git"
            },
            {
              "lessThan": "494de920d98f125b099f27a2d274850750aff957",
              "status": "affected",
              "version": "0446cafa843e6db4982731c167e11c80d42be7e2",
              "versionType": "git"
            },
            {
              "lessThan": "008508c16af0087cda0394e1ac6f0493b01b6063",
              "status": "affected",
              "version": "febab6b60d61d13cd9f30a2991deea56df39567d",
              "versionType": "git"
            },
            {
              "lessThan": "ddd46059f7d99119b62d44c519df7a79f2e6a515",
              "status": "affected",
              "version": "e23f075d77987de4215c8e0696f28bcc707506f7",
              "versionType": "git"
            },
            {
              "lessThan": "9958b9cbb22145295ee1ffaea0904c383da2c05d",
              "status": "affected",
              "version": "6b5ad4bd0d78fef6bbe0ecdf96e09237c9c52cc1",
              "versionType": "git"
            },
            {
              "lessThan": "bea2662e7818e15d7607d17d57912ac984275d94",
              "status": "affected",
              "version": "ab07506b0454bea606095951e19e72c282bfbb42",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/iwl-drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4.14.268",
              "status": "affected",
              "version": "4.14.263",
              "versionType": "semver"
            },
            {
              "lessThan": "4.19.231",
              "status": "affected",
              "version": "4.19.226",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.181",
              "status": "affected",
              "version": "5.4.174",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.102",
              "status": "affected",
              "version": "5.10.94",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.25",
              "status": "affected",
              "version": "5.15.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16.11",
              "status": "affected",
              "version": "5.16.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.268",
                  "versionStartIncluding": "4.14.263",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.231",
                  "versionStartIncluding": "4.19.226",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.181",
                  "versionStartIncluding": "5.4.174",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.102",
                  "versionStartIncluding": "5.10.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.25",
                  "versionStartIncluding": "5.15.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.11",
                  "versionStartIncluding": "5.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niwlwifi: fix use-after-free\n\nIf no firmware was present at all (or, presumably, all of the\nfirmware files failed to parse), we end up unbinding by calling\ndevice_release_driver(), which calls remove(), which then in\niwlwifi calls iwl_drv_stop(), freeing the \u0027drv\u0027 struct. However\nthe new code I added will still erroneously access it after it\nwas freed.\n\nSet \u0027failure=false\u0027 in this case to avoid the access, all data\nwas already freed anyway."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in the iwlwifi firmware-request callback during PCI probe/unbind, reached via local driver initialization and request_firmware_nowait\u2014not via WiFi frame processing or any network-facing path.\nAC:L - Once the failure/unbind path runs, the UAF is deterministic (device_release_driver frees drv, then iwl_dealloc_ucode uses it); no attacker-uncontrollable race is required to hit the bug.\nPR:L - A local unprivileged user on a system with Intel WiFi can be present when the driver probes with missing or unparseable firmware (common deployment failure mode), which is sufficient to reach the vulnerable path without needing real root beyond basic local access.\nUI:N - Firmware load and the subsequent unbind/UAF occur automatically in the async firmware callback during driver probe; no separate victim user action is required.\nS:U - This is a standard in-kernel UAF in the WiFi driver affecting the host kernel\u0027s own memory authority, with no VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - Use-after-free of struct iwl_drv lets an attacker reclaim the object and control fields later read as pointers, enabling disclosure of kernel memory contents.\nI:H - iwl_dealloc_ucode() performs multiple kfree() calls and a memset on the freed drv-\u003efw state, yielding arbitrary-free and memory-corruption primitives suitable for control-flow hijacking.\nA:H - Dereferencing and freeing poisoned/reused slab contents reliably causes kernel oops/panic, as confirmed by multiple real-world crash reports that motivated the fix."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:17.446Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb"
        },
        {
          "url": "https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957"
        },
        {
          "url": "https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515"
        },
        {
          "url": "https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94"
        }
      ],
      "title": "iwlwifi: fix use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48787",
    "datePublished": "2024-07-16T11:43:44.349Z",
    "dateReserved": "2024-07-16T11:38:08.891Z",
    "dateUpdated": "2026-08-05T08:52:17.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48787",
      "date": "2026-08-05",
      "epss": "0.00242",
      "percentile": "0.15425"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.14.263\", \"versionEndExcluding\": \"4.14.268\", \"matchCriteriaId\": \"D2BAC08D-1DF8-456A-A334-81FA58E954F0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.19.226\", \"versionEndExcluding\": \"4.19.231\", \"matchCriteriaId\": \"97E335CA-D0B4-4E7E-95AE-31F09C68F24A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.4.174\", \"versionEndExcluding\": \"5.4.181\", \"matchCriteriaId\": \"7C87A014-0685-4F19-AFB4-92D70C2F5E86\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10.94\", \"versionEndExcluding\": \"5.10.102\", \"matchCriteriaId\": \"2F8484B5-4C78-484C-B905-1049FCB1A0A4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15.17\", \"versionEndExcluding\": \"5.15.25\", \"matchCriteriaId\": \"AFF9E8A8-A352-42D0-97A3-8EA0F1086775\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16.3\", \"versionEndExcluding\": \"5.16.11\", \"matchCriteriaId\": \"85541B15-F4B0-4090-99DA-98AF1312A8B6\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niwlwifi: fix use-after-free\\n\\nIf no firmware was present at all (or, presumably, all of the\\nfirmware files failed to parse), we end up unbinding by calling\\ndevice_release_driver(), which calls remove(), which then in\\niwlwifi calls iwl_drv_stop(), freeing the \u0027drv\u0027 struct. However\\nthe new code I added will still erroneously access it after it\\nwas freed.\\n\\nSet \u0027failure=false\u0027 in this case to avoid the access, all data\\nwas already freed anyway.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: iwlwifi: corrige el use-after-free Si no hab\\u00eda ning\\u00fan firmware presente (o, presumiblemente, no se pudieron analizar todos los archivos de firmware), terminamos desvincul\\u00e1ndolo llamando a device_release_driver( ), que llama a remove(), que luego en iwlwifi llama a iwl_drv_stop(), liberando la estructura \u0027drv\u0027. Sin embargo, el nuevo c\\u00f3digo que agregu\\u00e9 seguir\\u00e1 accediendo err\\u00f3neamente a \\u00e9l despu\\u00e9s de que se haya liberado. Establezca \u0027failure=false\u0027 en este caso para evitar el acceso; todos los datos ya se liberaron de todos modos.\"}]",
      "id": "CVE-2022-48787",
      "lastModified": "2024-11-21T07:34:01.340",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-07-16T12:15:03.633",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48787\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T12:15:03.633\",\"lastModified\":\"2026-08-04T10:17:20.977\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niwlwifi: fix use-after-free\\n\\nIf no firmware was present at all (or, presumably, all of the\\nfirmware files failed to parse), we end up unbinding by calling\\ndevice_release_driver(), which calls remove(), which then in\\niwlwifi calls iwl_drv_stop(), freeing the \u0027drv\u0027 struct. However\\nthe new code I added will still erroneously access it after it\\nwas freed.\\n\\nSet \u0027failure=false\u0027 in this case to avoid the access, all data\\nwas already freed anyway.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iwlwifi: corrige el use-after-free Si no hab\u00eda ning\u00fan firmware presente (o, presumiblemente, no se pudieron analizar todos los archivos de firmware), terminamos desvincul\u00e1ndolo llamando a device_release_driver( ), que llama a remove(), que luego en iwlwifi llama a iwl_drv_stop(), liberando la estructura \u0027drv\u0027. Sin embargo, el nuevo c\u00f3digo que agregu\u00e9 seguir\u00e1 accediendo err\u00f3neamente a \u00e9l despu\u00e9s de que se haya liberado. Establezca \u0027failure=false\u0027 en este caso para evitar el acceso; todos los datos ya se liberaron de todos modos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/iwl-drv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8e10749fa1a454c1e7214f36cec83241f5a36ef1\",\"lessThan\":\"d3b98fe36f8a06ce654049540773256ab59cb53d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d7cc54137a4f28506dc7beac235b240b08f4e59\",\"lessThan\":\"7d6475179b85a83186ccce59cdc359d4f07d0bcb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0446cafa843e6db4982731c167e11c80d42be7e2\",\"lessThan\":\"494de920d98f125b099f27a2d274850750aff957\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"febab6b60d61d13cd9f30a2991deea56df39567d\",\"lessThan\":\"008508c16af0087cda0394e1ac6f0493b01b6063\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e23f075d77987de4215c8e0696f28bcc707506f7\",\"lessThan\":\"ddd46059f7d99119b62d44c519df7a79f2e6a515\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6b5ad4bd0d78fef6bbe0ecdf96e09237c9c52cc1\",\"lessThan\":\"9958b9cbb22145295ee1ffaea0904c383da2c05d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab07506b0454bea606095951e19e72c282bfbb42\",\"lessThan\":\"bea2662e7818e15d7607d17d57912ac984275d94\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/iwl-drv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.14.263\",\"lessThan\":\"4.14.268\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.226\",\"lessThan\":\"4.19.231\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.174\",\"lessThan\":\"5.4.181\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.94\",\"lessThan\":\"5.10.102\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.17\",\"lessThan\":\"5.15.25\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.16.3\",\"lessThan\":\"5.16.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:59:49.027467Z\",\"id\":\"CVE-2022-48787\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.263\",\"versionEndExcluding\":\"4.14.268\",\"matchCriteriaId\":\"D2BAC08D-1DF8-456A-A334-81FA58E954F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.226\",\"versionEndExcluding\":\"4.19.231\",\"matchCriteriaId\":\"97E335CA-D0B4-4E7E-95AE-31F09C68F24A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.174\",\"versionEndExcluding\":\"5.4.181\",\"matchCriteriaId\":\"7C87A014-0685-4F19-AFB4-92D70C2F5E86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.94\",\"versionEndExcluding\":\"5.10.102\",\"matchCriteriaId\":\"2F8484B5-4C78-484C-B905-1049FCB1A0A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.17\",\"versionEndExcluding\":\"5.15.25\",\"matchCriteriaId\":\"AFF9E8A8-A352-42D0-97A3-8EA0F1086775\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16.3\",\"versionEndExcluding\":\"5.16.11\",\"matchCriteriaId\":\"85541B15-F4B0-4090-99DA-98AF1312A8B6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:48:06+00:00",
      "cve": "CVE-2022-48787",
      "id": "CVE-2022-48787",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iwlwifi: fix use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48787.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:17:30Z",
      "cve": "CVE-2022-48787",
      "id": "CVE-2022-48787",
      "initial_release_date": "2024-07-17T04:19:19Z",
      "product_status:known_affected": "295",
      "product_status:known_not_affected": "201",
      "product_status:recommended": "511",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48787",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48787.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:01.764Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48787\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:59:49.027467Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.690Z\"}}], \"cna\": {\"title\": \"iwlwifi: fix use-after-free\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The UAF is in the iwlwifi firmware-request callback during PCI probe/unbind, reached via local driver initialization and request_firmware_nowait\\u2014not via WiFi frame processing or any network-facing path.\\nAC:L - Once the failure/unbind path runs, the UAF is deterministic (device_release_driver frees drv, then iwl_dealloc_ucode uses it); no attacker-uncontrollable race is required to hit the bug.\\nPR:L - A local unprivileged user on a system with Intel WiFi can be present when the driver probes with missing or unparseable firmware (common deployment failure mode), which is sufficient to reach the vulnerable path without needing real root beyond basic local access.\\nUI:N - Firmware load and the subsequent unbind/UAF occur automatically in the async firmware callback during driver probe; no separate victim user action is required.\\nS:U - This is a standard in-kernel UAF in the WiFi driver affecting the host kernel\u0027s own memory authority, with no VM escape, IOMMU bypass, or other cross-boundary impact.\\nC:H - Use-after-free of struct iwl_drv lets an attacker reclaim the object and control fields later read as pointers, enabling disclosure of kernel memory contents.\\nI:H - iwl_dealloc_ucode() performs multiple kfree() calls and a memset on the freed drv-\u003efw state, yielding arbitrary-free and memory-corruption primitives suitable for control-flow hijacking.\\nA:H - Dereferencing and freeing poisoned/reused slab contents reliably causes kernel oops/panic, as confirmed by multiple real-world crash reports that motivated the fix.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8e10749fa1a454c1e7214f36cec83241f5a36ef1\", \"lessThan\": \"d3b98fe36f8a06ce654049540773256ab59cb53d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1d7cc54137a4f28506dc7beac235b240b08f4e59\", \"lessThan\": \"7d6475179b85a83186ccce59cdc359d4f07d0bcb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0446cafa843e6db4982731c167e11c80d42be7e2\", \"lessThan\": \"494de920d98f125b099f27a2d274850750aff957\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"febab6b60d61d13cd9f30a2991deea56df39567d\", \"lessThan\": \"008508c16af0087cda0394e1ac6f0493b01b6063\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e23f075d77987de4215c8e0696f28bcc707506f7\", \"lessThan\": \"ddd46059f7d99119b62d44c519df7a79f2e6a515\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6b5ad4bd0d78fef6bbe0ecdf96e09237c9c52cc1\", \"lessThan\": \"9958b9cbb22145295ee1ffaea0904c383da2c05d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ab07506b0454bea606095951e19e72c282bfbb42\", \"lessThan\": \"bea2662e7818e15d7607d17d57912ac984275d94\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/iwl-drv.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.14.263\", \"lessThan\": \"4.14.268\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.226\", \"lessThan\": \"4.19.231\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.174\", \"lessThan\": \"5.4.181\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.94\", \"lessThan\": \"5.10.102\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.17\", \"lessThan\": \"5.15.25\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.16.3\", \"lessThan\": \"5.16.11\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/iwl-drv.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d\"}, {\"url\": \"https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb\"}, {\"url\": \"https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957\"}, {\"url\": \"https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063\"}, {\"url\": \"https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515\"}, {\"url\": \"https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d\"}, {\"url\": \"https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niwlwifi: fix use-after-free\\n\\nIf no firmware was present at all (or, presumably, all of the\\nfirmware files failed to parse), we end up unbinding by calling\\ndevice_release_driver(), which calls remove(), which then in\\niwlwifi calls iwl_drv_stop(), freeing the \u0027drv\u0027 struct. However\\nthe new code I added will still erroneously access it after it\\nwas freed.\\n\\nSet \u0027failure=false\u0027 in this case to avoid the access, all data\\nwas already freed anyway.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.268\", \"versionStartIncluding\": \"4.14.263\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.231\", \"versionStartIncluding\": \"4.19.226\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.181\", \"versionStartIncluding\": \"5.4.174\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.102\", \"versionStartIncluding\": \"5.10.94\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.25\", \"versionStartIncluding\": \"5.15.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.11\", \"versionStartIncluding\": \"5.16.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:52:17.446Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48787\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:52:17.446Z\", \"dateReserved\": \"2024-07-16T11:38:08.891Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-16T11:43:44.349Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.